ansaurus

Question

Function to Sanitize HTML Id attribute in Java

Answer 1

A:

You could significantly shorten your code by using Character.isLetterOrDigit(char); e.g.

for(int i = 0; i < s.length(); i++) {
  char c = s.charAt(i);

  if (Character.isLetterOrDigit(c) || c == '.' || etc ...) {

  }
}

You could do this in conjunction with storing the permitted punctuation characters in a Set; e.g.

private static final Set<Character> ALLOWED =
  new HashSet<Character>(Arrays.asList('.', '-', '_', ':'));

for(int i = 0; i < s.length(); i++) {
  char c = s.charAt(i);

  if (ALLOWED.contains(c)) {

  }
}

Adamski 2009-09-10 09:13:53

FYI: the character e-acute `'\u00e9'` is a letter or digit, but not a valid HTML identifier. That method will return true for a wide range of Unicode characters.

McDowell 2009-09-10 09:36:26

Answer 2

A:

You might want to check the expressions (regex isn't my forte), but this should drop invalid characters:

  private static Pattern INVALID_LEADING = Pattern.compile("^[^a-zA-Z]+");
  private static Pattern INVALID = Pattern
      .compile("[^\\w\\u002e\\u003a\\u002d\\u005f]+");

  private static String sanitize(String id) {
    Matcher matcher = INVALID_LEADING.matcher(id);
    if (matcher.find()) {
      id = matcher.replaceFirst("");
    }
    Matcher invalid = INVALID.matcher(id);
    if (invalid.find()) {
      id = invalid.replaceAll("");
    }
    return id;
  }

If you aren't happy with regex, be aware that many of your characters are in contiguous ranges, so can be detected with methods like this:

  private static boolean isLatinDigit(char ch) {
    return ch >= '0' && ch <= '9';
  }

McDowell 2009-09-10 09:41:37

Answer 3

+1 A:

I would do something like this:

/**
 * 
 * HTML 4 Specification ID and NAME tokens must begin with a letter
 * ([A-Za-z]) and may be followed by any number of letters, digits ([0-9]),
 * hyphens ("-"), underscores ("_"), colons (":"), and periods (".").
 * 
 * @param s
 * @return
 */
public static String sanitizeHTMLIdAttribute(String s) {
 if (s == null) return null;
 StringBuilder sb = new StringBuilder();
 int firstLegal = 0;
 while (firstLegal < s.length() && !isAZ(s.charAt(firstLegal)))
  ++firstLegal;
 for (int i = firstLegal; i < s.length(); ++i){
  final char ch = s.charAt(i);
  if (isOkIdInnerChar(ch)) sb.append(ch);
 }
 return sb.length() == s.length()? s : sb.toString();
}

private static boolean isOkIdInnerChar(char ch) {
 return isAZ(ch) || isNum(ch) || isSpecial(ch);
}

private static boolean isSpecial(char ch) {
 switch (ch) {
 case '-': case '_':
 case ':': case '.':
  return true;
 default:
  return false;
 }
}

private static boolean isAZ(char ch) {
 return ('A' <= ch && ch <= 'Z') || ('a' <= ch && ch <= 'z'); 
}

private static boolean isNum(char ch) {
 return '0' <= ch && ch <= '9';
}

... except that I'd probably prefer to throw an NullPointerException if s == null, and IllegalArgumentException if s contains no legal characters, but that's a matter of preference, of course. Some extra features:

If s is a valid ID, it's returned as-is to save space (fewer string instances floating around) and time (String construction is expensive -- yes, I know allocation is cheap, but there's more going on there than allocation).
I don't use Character.isDigit 'cause it returns true for all Unicode digits, including stuff like "٣"
I don't use Character.isLetter 'cause it returns true for all Unicode letters, including stuff like "å"

gustafc 2009-09-10 10:36:38

ansaurus

tags:

views:

answers:

Function to Sanitize HTML Id attribute in Java

related questions